                                (assoc-in [:session :user-login] (:login user))
                                ;; stale csrf token can cause session to be lost
                                (assoc-in [:session :csrf-token] "staleCSRFtoken"))
-                   response (oauth/authorise @storage/user-store request)]
+                   response (oauth/authorise user-store request)]
                (:status response) => 302
                (get-in response [:headers "Location"]) => (contains (str client-url "?code="))
                (get-in response [:session :access_token]) => (:token access-token)

            [stonecutter.controller.oauth :as oauth]
            [stonecutter.db.storage :as storage]
            [stonecutter.db.client :as client]
            [stonecutter.db.user :as user])
  (:import (org.apache.commons.codec.binary Base64)))

(background


(facts "about authorisation end-point"
       (fact "request with client-id, response_type and redirect_uri returns redirect to login page if there is no user session"
             (let [user-store (m/create-memory-store)
                   client-details (cl-client/register-client @storage/client-store "ClientTestApp" client-url) ;FORMAT => {:client-secret "XLFCQRKJXSV3T6YQJL5ZJJVGFUJNT6LD", :client-id "RXBX6ZXAER5KPDSZ3ZCZJDOBS27FLDE7", :name "ClientTestApp", :url "localhost:3001"}
                   request (-> (th/create-request-with-query-string :get (routes/path :authorise)
                                                                    {:client_id     (:client-id client-details)
                                                                     :response_type "code"
                                                                     :redirect_uri  client-url})
                               (r/header "accept" "text/html"))
                   response (oauth/authorise (m/create-memory-store) request)]
               (:status response) => 302
               (-> response (get-in [:headers "Location"])) => "/sign-in"
               (-> response (get-in [:session :return-to])) => (format "/authorisation?client_id=%s&response_type=code&redirect_uri=%s" (:client-id client-details) (hiccup/url-encode client-url))))

       (fact "valid request goes to authorisation page with auth_code and email when there is an existing user session"
             (let [user-store (m/create-memory-store)
                   user (user/store-user! user-store user-email "password")
                   client-details (cl-client/register-client @storage/client-store "MYAPP" client-url) ; NB this saves into the client store
                   access-token (cl-token/create-token @storage/token-store client-details user) ; NB this saves into the token store
                   request (-> (th/create-request-with-query-string :get (routes/path :authorise)
